6mo ago

Windows 11 BitLocker Bypassed to Extract Encryption Keys

An attacker with physical access can abruptly restart the device and dump RAM, as analysis of this memory may reveal FVEK keys from recently running Windows instances, compromising data encryption.

The effectiveness of this attack is, however, limited because the data stored in RAM degrades rapidly after the power is cut off.

24 comments

This exploit requires physical access, and if you have physical access, anything is possible. Secure your shit better.
- Bitlocker is designed to aid against phyiscal attacks, so physical access is a given.
  
  the best you can ever do is make physical attacks more inconvenient, and it succeeds at that.
  Here's another "critical vulnerability": the attacker can insert a physical device to intercept all keystrokes, and steal the key whenever the user enters it. A hidden camera can also accomplish this
- Physical access to a running device, for clarity.
  Edit: Unless you use a TPM with no pin/password, which is dumb.
  
  It doesn't already have to be running. BitLocker retrieves its keys from TPM by default, so just booting a device will place the keys in memory.
  To minimize downtime, abruptly restart the target system during the Windows boot process, specifically before the login screen appears, as this approach has proven effective in scenarios involving the retrieval of Full Volume Encryption Keys (FVEKs).
  By kernel-level debugging with WinDbg, the researcher observed BitLocker operations during the Windows boot process, which revealed that while Microsoft attempts to erase encryption keys using functions like SymCryptSessionDestroy, some keys persist on the heap, potentially due to incomplete key destruction mechanisms.
A "cold boot" attack. These have been around for a while.
The degredation is not a huge barrier. Spraying inverted canned air can cool the DRAM enough to preserve it for a little while, even long enough to switch it to a new motherboard. Whenever the motherboard is powered, the DRAM is being refreshed, so won't degrade. A few bits lost is no fatal flaw, since most cold boot attack algorithms search for long key schedules, not just the key.
Bitlocker is extra vulberable because it stores the key in the TPM and requires no password to boot. An attacker can extract the key even if the computer is off when they get it.
- Bitlocker is extra vulberable because it stores the key in the TPM and requires no password to boot. An attacker can extract the key even if the computer is off when they get it.
  This is not true.
  You would additionally need to bypass Secure Boot with a separate exploit such as the one in this article (which is mitigated by disabling USB boot) or LogoFAIL to put the TPM PCRs in a state where the keys can be released.
  LUKS2 is no different here as either can be TPM-only or require a separate PIN.
  
  Yes, assuming it's durably sealed and tamper-proof. If you have enough physical access, though, you can remove the DRAM and put it in another machine to scrape it. This adds time, but it has been done before. One experiment dipped the DRAM in liquid nitrogen for an hour, and found 0.13% decay.
- What's the advantage of disk encryption if you don't require a password to boot? Couldn't you just boot the device and extract the data using Explorer anyway?
  
  Its kinda useful for devices where userland is also protected against exfil, like a kiosk or windows lock screen.
  If the bios is hardened, secure boot on, bitlocker on, and windows is locked with a password, you can't simply take the disk out and manipulate it cause bitlocker with TPM means only that specific hardware profile will decrypt the disk automatically.
  You can't get to explorer cause the system is locked with windows auth, and you can't reset the PW cause bitlocker is on, and you cant remove the disk cause the TPM protects against that with bitlocker.
  Its really not perfect, and I'm not advocating for it, but its a decent protection in systems where adding another pin/password isn't practical.
  Even Microsoft recommends at least also using a pin with bitlocker.
  
  I assume they think the Windows login password will keep them safe. I don't know. But many corporate computers (several I've been forced to use) do use Bitlocker without a password.
- All secure implementations of Bitlocker also use a password on boot. Use of a TPM is not unique to Bitlocker either.
Is this really a BitLocker issue or more an issue inherent in the hardware design?
EDIT: Okay, looks like Microsoft could do better:
By kernel-level debugging with WinDbg, the researcher observed BitLocker operations during the Windows boot process, which revealed that while Microsoft attempts to erase encryption keys using functions like SymCryptSessionDestroy, some keys persist on the heap, potentially due to incomplete key destruction mechanisms.
But maybe the hardware/UEFI should immediately wipe memory upon restarting anyway..?
- The key has to be stored somewhere to be able to use it. This is full disk encryption, so every single sector that is read or written (except some boot and kernel stuff, presumably) needs to go through that encryption key. You could maybe store it in a cryptographic coprocessor that uses SRAM for the key and key schedule, but those are very uncommon now that AES-NI is popular. And I don't think AES-NI has any special registers that could help here.
Is LUKS2 resistant against Cold Boot attacks?
- Any encryption system that uses the CPU to decrypt will need the key in memory, so yes it can be attacked in a similar manner.

24 comments